Embodiments of the present invention relate to systems and methods for thwarting denial of service attacks originating in a DOCSIS-compliant cable network. Particular systems and methods are directed to detecting “spoofed” source IP addresses in messages sent from cable modems and to metering DNS queries from specific source IP addresses in a cable network environment.
The Internet, also termed the “information superhighway”, has revolutionized how data and information can be accessed. Presently, “online” information sources mirror most of the information available from traditional sources such as newspapers, reference books, databases and other public information sources. Users are also able to subscribe to private information sources, order goods and services and download information content and receive radio and television transmissions. Communication between users is also available and includes “chat” rooms, semi-private virtual area networks, telephone service (termed voice over Internet protocol or VoIP) and online competitive video gaming.
As uses of the Internet increase, users seek faster connection speeds and greater bandwidth. Data over cable networks are becoming a preferred solution in providing high data transfer rates to users at attractive pricing. At increased bandwidth, user enjoyment is enhanced with shorter wait and download times.
Users select the Internet websites they wish to connect to by identifying the website by its Internet Protocol (IP) address or its domain name. Most users prefer using domain names instead of the IP address. Primary amongst the reasons for this preference is the ease of remembering domain names and the implementation of dynamically assigned Internet addresses to particular domain names.
A DNS server receives a name from a user, associates the name with an IP address, and sends the IP address to the user. The user then communicates with a server via the server's IP address. If a DNS server does not know the address associated with a particular name, the DNS server contacts a root name server. A root server “knows” the IP address for all of the DNS servers that handle the top-level domains. For example, a DNS server might “ask” a root server for the IP address associated with www.Yahoo.com, and the root might “respond” (assuming no caching), “I don't know the IP address for Yahoo.com, but here's the IP address for the COM name server.” Of the various software available for operating a DNS server, most common is the UNIX based Berkeley Internet Name Domain (BIND) software.
While DNS makes the Internet more user friendly, DNS servers are used by malicious attackers bent on disrupting normal communications over the Internet. Such attacks are generally referred to as denial of service (DoS) attacks. While some DoS attacks do not involve DNS servers directly (e.g., attacks that exploit implementation bugs and attacks that exploit legitimate protocol features of an Internet service), attacks on server bandwidth use the DNS to congest a target's networks with (useless) traffic. The high volume of incoming DNS requests can cause routers to crash, compounding the problem. Some bandwidth attacks generate easily identifiable packets that can be filtered or rate-limited because they never occur in high volume during normal operations. Other bandwidth attacks may look like transient high volume traffic.
To be effective, bandwidth attacks require a group of attackers to cooperate in order to generate sufficient traffic. A variant of the DoS is the “distributed” DoS or “DDoS.” An attacker using this form of attack breaks into hundreds or thousands of computers connected to the Internet and installs software on them that allows the attacker to control all the captured computers. The attacker then launches coordinated attacks on a target site by issuing a single command to the captured machines instructing them to launch a particular attack against a specific target. When the attacker decides to stop the attack, another single command is sent. These attacks typically exhaust bandwidth, router processing capacity, or network stack resources, breaking network connectivity to the targets.
Tracing the origins of a DoS attack is difficult to say the least. Devices on the Internet are identified via IP addresses. IP addresses are structured (organized into groups) so that special-purpose traffic-handling computers, called routers, can direct messages (in the form of packets) in the right direction to reach their intended destination. Each of these packets is handled separately by the Internet and reassembled at the remote computer. Each of these packets has a pair of addresses in it, called the source and destination IP addresses. These are the addresses of the originating machine, and the recipient. They are analogous to the address and return address on an envelope, in traditional mail.
When a packet is sent over the Internet, it is passed first to the nearest router; commonly this router is at the point where the local network connects to the Internet. This router is often called a border router. The border router passes it upstream to a core router, which interconnects with many other core routers all over the Internet; the core routers pass the packet on until it reaches its destination as determined by the destination IP address. The source IP address is normally ignored by routers.
A router necessary “knows” the addresses of every network attached to it, so that it can correctly route packets to them. In a DDoS attack, the source addresses is forged or “spoofed.” The border router, the first router to receive a packet, is in a position to look at the source address, determine whether it matches the network it's coming from, and, if not, discard the packet. However, if the packet is forwarded by the border server, downstream servers will not be able to detect the forged source IP address and the attack will be all but unstoppable.
A DNS server offers an attacker a convenient means for executing a packet flooding denial of service attacks. An attacker sends a large number of UDP-based DNS requests to a DNS server using a spoofed source IP address. Any DNS server response is sent back to the spoofed IP address as the destination. In this scenario, the spoofed IP address represents the target of the denial of service attack. The DNS server is an intermediate party in the attack. The true source of the attack is difficult for an intermediate or a target site to determine due to the use of spoofed source addresses. Because DNS server responses can be significantly larger than DNS requests, there is potential for bandwidth amplification. In other words, the responses may consume more bandwidth than the requests. An intruder may use multiple DNS servers on diverse networks in this type of an attack to achieve a DDoS attack against target sites.
An intermediary DNS server may receive packets back from the target. In particular, port unreachable packets may be returned from the target to the intermediary in response to an unexpected UDP packet sent from the intermediary DNS server to the target host. Sites with DNS servers used as intermediaries may experience performance degradation and a denial of DNS service as a result of an increase in DNS query traffic. It is also possible to experience higher bandwidth consumption and a bandwidth denial of service attack on the intermediary DNS server's network. Target sites may experience a bandwidth denial of service attack due to a high volume of DNS response packets being forwarded by one or more intermediary DNS servers.
Spoofing is also employed in attacks that exploit the hand-shake mechanism used by the transmission control protocol (TCP). TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent. Any system connected to the Internet and providing TCP-based network services, such as a Web server, FTP server, or mail server, is potentially subject to an attack that exploits the TCP handshake. A TCP connection starts with a client sending a SYN message to a server, indicating the client's intention to establish a TCP connection. The server replies with a SYN/ACK message to acknowledge that it has received the initial SYN message, and at the same time reserves an entry in its connection table and buffer space. After this exchange, the TCP connection is considered to be half open. To complete the TCP connection establishment, the client must reply to the server with an ACK message. In a TCP SYN flooding attack, an attacker, sends many SYN messages, with fictitious (spoofed) IP addresses, to a single server (target). Although the server replies with SYN/ACK messages, these messages are never acknowledged by the client. The half-open connections data structure on the target server system will eventually fill until server is unable to accept any new incoming connections. While a timeout can be associated with a pending connection to expire half-open connections, the attacking system can simply continue sending IP-spoofed packets requesting new connections faster than the victim system can expire the pending connections. In most cases, the victim of such an attack will have difficulty in accepting any new incoming network connection. In these cases, the attack does not affect existing incoming connections nor the ability to originate outgoing network connections.
In a variation of the TCP SYN flooding attack, the spoofed source address is a real address and is the target (or a second target) of the attack. The ACK messages from the first target server are sent to the address of the second target server, overwhelming the second target with message traffic requiring that it send an ACK message. The second target server's resources are ultimately consumed disrupting its operation.
The location of the attacking system is obscured because the source addresses in the SYN packets are often implausible. When the packet arrives at the victim server system, there is no way to determine its true source. Since the network forwards packets based on destination address, the only effective way to validate the source of a packet is to use input source filtering. This can be accomplished by checking whether the “AWK” bit is set in the header. If the packet is a first packet, the AWK bit is not set. If the packet is a response packet, the AWK bit in the head is set.
Another attack form that relies on spoofing of the source IP address uses user datagram protocol (UDP) packets in place of TCP packet. TCP is the protocol most commonly used for services on the Internet. For example, Telnet, FTP, SMTP, NNTP, and HTTP are all TCP-based services. TCP is reliable in that it makes three guarantees to the application layer: the destination will receive the application data in the order it was sent, the destination will receive all the application data, and the destination will not receive duplicates of any of the application data. TCP is bi-directional in that once a connection is established, a server can reply to a client over the same connection. By contrast, UDP is a low-overhead alternative to TCP because it makes none of the reliability guarantees made by TCP (delivery, ordering, and nonduplication) and doesn't require reliability mechanisms to support it. Every UDP packet is independent, which means that unlike TCP, UDP packets are not part of a “virtual circuit.”
UDP packets are very similar to TCP packets in structure. A UDP header contains UDP source and destination port numbers, just like the TCP source and destination port numbers. However, a UDP header does not contain an ACK bit and does not use the SYN/ACK handshake. There is no way for a packet filtering router to determine, simply by examining the header of an incoming UDP packet, whether that packet is a first packet from an external client to an internal server, or a response from an external server back to an internal client.
In a UDP-based attack, an intruder sends a large number of UDP-based DNS requests to a DNS server using a spoofed source IP address. Any DNS server response is sent back to the spoofed IP address as the destination. In this scenario, the spoofed IP address represents the victim of the denial of service attack. The DNS server is an intermediate party in the attack. The true source of the attack is difficult for an intermediate or a victim site to determine due to the use of spoofed source addresses. As noted earlier, because DNS server responses can be significantly larger than DNS requests, there is potential for bandwidth amplification. In other words, the responses may consume more bandwidth than the requests.
Multiple DNS servers on diverse networks can be used in this type of an attack to achieve a distributed denial of service attack against victim sites. UDP DNS queries can be crafted to request the same valid DNS resource record from multiple DNS servers. The result is many DNS servers receiving queries for resources records in zones for which the DNS server is not authoritative. The response of the DNS server depends on its configuration. If the target DNS server allows the query and is configured to be recursive or to provide referrals, the DNS server's response could contain significantly more data than the original DNS request, resulting in a higher degree of bandwidth amplification. A target DNS server configured without restrictions on DNS query sources may not log malicious queries at all.
The intermediary DNS server may receive packets back from the victim host. In particular, ICMP port unreachable packets may be returned from the victim to the intermediary in response to an unexpected UDP packet sent from the intermediary DNS server to the victim host. Sites with DNS servers used as intermediaries may experience performance degradation and a denial of DNS service as a result of an increase in DNS query traffic. It is also possible to experience higher bandwidth consumption and a bandwidth denial of service attack on the intermediary DNS server's network. Victim sites may experience a bandwidth denial of service attack due to a high volume of DNS response packets being forwarded by one or more intermediary DNS servers.
Cable networks have become popular means for high-speed data connections to the Internet. Cable networks that comply with Data Over Cable Service Interface Specification (DOCSIS) standards (DOCSIS version 1.0 was issued in 1997 and DOCSIS version 1.1 replaced version 1.0 in 1999-2001) offer connectivity through a cable modem (CM) that is managed and monitored by a cable modem termination system (CMTS). One advantage of a DOCSIS-compliant network (DCN) is that the IP address of the CM and the IP addresses of other devices connected to the CM are issued by systems under the control of the DNS.
It is desirable to implement systems and methods to thwart DoS attacks that originate from within a DCN by detecting “spoofed” source IP addresses in messages sent from cable modems and by metering DNS queries from specific source IP addresses within a DCN. As is demonstrated below, applicants have developed such systems and methods that have additional benefits of reducing cable network load factors and reducing the potential that packets originating from the DCN will be blocked by other Internet service providers.